Medium
CVE-2024-47847
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2024-47913
Improper permissions handling in MediaWiki AbuseFilter
Low
CVE-2024-47764
cookie accepts cookie name, path, and domain with out of bounds characters
Medium
CVE-2024-47765
Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS
High
CVE-2024-47183
Parse Server's custom object ID allows to acquire role privileges
Medium
CVE-2024-9455
WP Cleanup and Basic Functions <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2024-9385
Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting
Medium
CVE-2024-47855
JSON-lib mishandles an unbalanced comment string
Medium
CVE-2024-9417
Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload
High
CVE-2024-9314
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2024-9161
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Missing Authorization to Unauthenticated User and Term Metadata Insert, Update, and Delete
Medium
CVE-2024-9528
Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting
Medium
CVE-2024-8743
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.5.7 - Authenticated (Subscriber+) Limited JavaScript File Upload
Medium
CVE-2024-8486
Shortcodes and extra features for Phlox theme <= 2.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets
High
ghsa-fm76-w8jw-xf8m
@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source
Low
CVE-2024-9266
Express Open Redirect vulnerability
Medium
CVE-2024-9271
Re:WP <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2024-9071
Easy Demo Importer – A Modern One-Click Demo Import Solution <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
High
ghsa-78p3-fwcq-62c2
@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings
Medium
ghsa-cfqx-f43m-vfh7
@saltcorn/server arbitrary file and directory listing when accessing build mobile app results
Medium
ghsa-277h-px4m-62q8
@saltcorn/server arbitrary file zip read and download when downloading auto backups
Medium
ghsa-593m-55hh-j8gv
Sentry SDK Prototype Pollution gadget in JavaScript SDKs
Medium
CVE-2024-47617
Injection of arbitrary HTML/JavaScript code through the media download URL
Medium
CVE-2024-47618
Cross-site Scripting via uploaded SVG
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.